PT-2024-31133 · Unknown+1 · Github.Com/Gomarkdown/Markdown+1

Published 2024-10-15 · Updated 2026-04-15 · CVE-2024-44337

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions github.com/gomarkdown/markdown versions prior to v0.0.0-20240729232818-a2a9c4f

Description The issue is related to a logical problem in the paragraph function of the parser/block.go file, which allowed a remote attacker to cause a denial of service (DoS) condition by providing a tailor-made input that caused an infinite loop, causing the program to hang and consume resources indefinitely.

Recommendations For versions prior to v0.0.0-20240729232818-a2a9c4f, update to a version that includes the fixes provided in commit a2a9c4f76ef5a5c32108e36f7c47f8d310322252 to resolve the issue. As a temporary workaround, consider restricting the input to the github.com/gomarkdown/markdown package to prevent the infinite loop condition.

Exploit

Fix

Infinite Loop

Weakness Enumeration

CWE-835

Related Identifiers

AZL-50618

CVE-2024-44337

GHSA-XHR3-WF7J-H255

GO-2024-3205

OPENSUSE-SU-2024:14599-1

OPENSUSE-SU-2025:14753-1

Affected Products

Debian

Github.Com/Gomarkdown/Markdown

References · 43

• 🔥 https://github.com/Brinmon/CVE-2024-44337 · Exploit
• https://osv.dev/vulnerability/openSUSE-SU-2025:14753-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-44337 · Security Note
• https://osv.dev/vulnerability/GO-2024-3205 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-44337 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:14599-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-44337 · Security Note
• https://osv.dev/vulnerability/GHSA-xhr3-wf7j-h255 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-44337 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-50618 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-44337 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-44337 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-44337 · Vendor Advisory
• https://github.com/gomarkdown/markdown · Note
• https://github.com/gomarkdown/markdown/commit/a2a9c4f76ef5a5c32108e36f7c47f8d310322252 · Note